Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Threat actors behind the Aurora ransomware are exploiting AI coding assistants like Cursor to accelerate and refine their attack planning, including the abuse of Active Directory Certificate Services (ADCS) — a frequently misconfigured and over-privileged component in enterprise environments. This highlights that AI tools are now lowering the technical barrier for attackers, enabling faster exploitation of complex infrastructure weaknesses. The targeting of ADCS is particularly dangerous because certificate-based attacks can grant persistent, high-privilege access that is difficult to detect. The ransomware's ability to shut down virtual machines before encrypting Linux systems also demonstrates sophisticated operational planning designed to maximize damage and prevent recovery. Organizations must treat AI-assisted threats as an accelerant that shortens the window between vulnerability disclosure and active exploitation.